Description
libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key, if that previous request timed out due to a low `POLL_TIMEOUT`. This issue has been addressed in version 1.1.4. Users are advised to upgrade. There are several ways to workaround or lower the probability of this bug affecting a given deployment. 1: use a reasonably high `POLL_TIMEOUT` setting, like the default. 2: use separate libmemcached connections for unrelated data. 3: do not re-use libmemcached connections in an unknown state.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| awesomized | libmemcached | > 1.0.18, < 1.1.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmemcached | 1.1.4-1 | — |
| Debian 13 | libmemcached | 1.1.4-1 | — |
| Debian 12 | libmemcached | 1.1.4-1 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libmemcached-awesome | 1.1.4-1 | — |
| Azure Linux 2 (CBL-Mariner) | libmemcached-awesome | 1.1.4-1 | — |
Advisories 1
- WID-SEC-2023-0607 memcached: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Mar 8, 2023